Actors/Nation-state / APT/Europe

APT28

G0007APTRU · Russia

AKA SNAKEMACKEREL · Tsar Team · Pawn Storm · TG-4127 · STRONTIUM · Swallowtail · ITG05 · ATK5 · Group 74 · Grizzly Steppe · Sednit Group

ESET: SednitKaspersky: SofacyMicrosoft: Forest BlizzardCrowdStrike: FANCY BEARSecureworks: Iron TwilightMITRE: G0007Proofpoint: TA422PwC: Blue Athena

Russian military intelligence cyber-espionage group attributed to GRU Unit 26165.

Targets25

Sectors10

Threat types2

GIRs mapped0/480

Active since2007

Explore in atlas

Also tracked as

9 vendor names · 11 other aliases

Open Rosetta Stone

CrowdStrike

FANCY BEAR

ESET

Sednit

Kaspersky

Sofacy

Mandiant

APT28

Microsoft

Forest Blizzard

MITRE

G0007

Proofpoint

TA422

PwC

Blue Athena

Secureworks

Iron Twilight

UNATTRIBUTED ALIASESSNAKEMACKERELTsar TeamPawn StormTG-4127STRONTIUMSwallowtailITG05ATK5Group 74Grizzly SteppeSednit Group

Victimology

Geographic footprint · 25 countries

Export STIX

origin · Russiatargeted countries · 25

ASIA · 6

Armenia · Iran · South Korea · Kazakhstan · Malaysia · Uzbekistan

AMERICAS · 2

Argentina · Brazil

EUROPE · 17

Belgium · Belarus · Switzerland · Germany · France · United Kingdom · Croatia · Hungary · Latvia · Montenegro · Netherlands · Poland · Romania · Serbia · Sweden · Slovakia · Ukraine

Sectors targeted

10 of 40

Government100 actors Defense72 actors Aerospace58 actors NGOs & Dissidents56 actors Energy / Utilities58 actors Media & Journalism48 actors Transportation31 actors Hospitality32 actors Private Sector (generic)29 actors Extractive Industries8 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

DIS · DisinformationESP · Espionage

MITRE ATT&CK · 76 techniques

Reconnaissance · 4

T1589.001Credentials T1591Gather Victim Org Information T1596Search Open Technical Databases T1598Phishing for Information

Resource Development · 3

T1583.001Domains

Initial Access · 7

T1189Drive-by Compromise

Execution · 6

T1047Windows Management Instrumentation

Persistence · 6

T1037Boot or Logon Initialization Scripts T1037.001Logon Script (Windows)

Privilege Escalation · 1

T1068Exploitation for Privilege Escalation

Credential Access · 9

T1003OS Credential Dumping

Discovery · 3

T1057Process Discovery

Lateral Movement · 5

T1021.002SMB/Windows Admin Shares

Collection · 9

T1005Data from Local System T1025Data from Removable Media T1039Data from Network Shared Drive T1113Screen Capture

Exfiltration · 2

T1030Data Transfer Size Limits T1567Exfiltration Over Web Service

Impact · 1

T1498Network Denial of Service

Command And Control · 7

T1001.001Junk Data T1071.001Web Protocols T1071.003Mail Protocols

Stealth · 13

T1014Rootkit T1036Masquerading T1036.005Match Legitimate Resource Name or Location

GIR mappings

0 / 480 requirements mapped

Open matrix

No GIRs mapped yet for this actor.

References

No supporting references have been recorded for this profile. Treat uncited claims as unverified.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer76 techniques · layer format 4.5

Related actors

By origin and actor type

T1583.003

Virtual Private Server

T1583.006Web Services

T1190

Exploit Public-Facing Application

T1199Trusted Relationship

T1566Phishing

T1566.001Spearphishing Attachment

T1566.002Spearphishing Link

T1669Wi-Fi Networks

T1059.001

PowerShell

T1059.003Windows Command Shell

T1059.009Cloud API

T1203Exploitation for Client Execution

T1204.001Malicious Link

T1098.002

Additional Email Delegate Permissions

T1133External Remote Services

T1137.002Office Test

T1547.001Registry Run Keys / Startup Folder

T1003.001

LSASS Memory

T1003.002Security Account Manager

T1003.003NTDS

T1003.004LSA Secrets

T1040Network Sniffing

T1110Brute Force

T1528Steal Application Access Token

T1557.004Evil Twin

T1083

File and Directory Discovery

T1120Peripheral Device Discovery

T1091

Replication Through Removable Media

T1210Exploitation of Remote Services

T1550.001Application Access Token

T1550.002Pass the Hash

T1114.002

Remote Email Collection

T1119Automated Collection

T1213Data from Information Repositories

T1560Archive Collected Data

T1560.001Archive via Utility

T1090.003

Multi-hop Proxy

T1092Communication Through Removable Media

T1102.002Bidirectional Communication

T1105Ingress Tool Transfer

T1070.004

File Deletion

T1078Valid Accounts

T1078.004Cloud Accounts

T1140Deobfuscate/Decode Files or Information

T1211Exploitation for Stealth

T1218.011Rundll32

T1221Template Injection

T1564.001Hidden Files and Directories

T1564.003Hidden Window

T1684.001Impersonation